CVE-2015-8660
CVE-2015-8660
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
Affected products
n/a · n/apublic PoCs found — 10
githubgithub.com/whu-enjoy/CVE-2015-8660★ 3githubgithub.com/nhamle2/CVE-2015-8660★ 0githubgithub.com/carradolly/CVE-2015-8660★ 0cve_referencewww.exploit-db.com/exploits/40688/unverifiedexploitdbwww.exploit-db.com/exploits/40688unverifiedexploitdbwww.exploit-db.com/exploits/39166unverifiedcve_referencepacketstormsecurity.com/files/135151/Ubuntu-14.04-LTS-15.10-overlayfs-Local-Root.htmlunverifiedexploitdbwww.exploit-db.com/exploits/39230unverifiedcve_referencewww.exploit-db.com/exploits/39166/unverifiedcve_referencewww.exploit-db.com/exploits/39230/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00043.htmlhttp://packetstormsecurity.com/files/135151/Ubuntu-14.04-LTS-15.10-overlayfs-Local-Root.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1532.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1539.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1541.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1291329https://github.com/torvalds/linux/commit/acff81ec2c79492b180fade3c2894425cd35a545https://www.exploit-db.com/exploits/39166/https://www.exploit-db.com/exploits/39230/